Security readout for executives and security teams
Plain-English summary
CVE-2021-24016 is a Fortinet FortiManager CSV export issue. If a privileged attacker can place crafted content in a policy-related IPv4 field, and a user exports and opens the file unsafely in Excel, commands may run on that user's workstation.
Executive priority
Handle during normal vulnerability management unless FortiManager administrators routinely exchange exports or untrusted admins can alter policy data. The business risk is mainly workstation compromise through unsafe spreadsheet handling, not direct FortiManager takeover.
Technical view
The issue is improper neutralization of formula elements in FortiManager CSV output. Sources describe FortiManager 6.4.3 and below, and 6.2.7 and below, where crafted policy data can become dangerous when exported as an Excel-opened CSV. CVSS is 3.7 low with high privileges and user interaction required.
Likely exposure
Exposure is limited to organizations running affected FortiManager versions where privileged users or attackers can influence policy data and staff export that data to Excel-compatible files.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. Practical exploitation appears constrained by high privileges, high complexity, adjacent access, and victim interaction through unsafe spreadsheet opening.
Researcher notes
Evidence is sparse in the provided bundle. The description supports CSV formula injection leading to command execution only after export and unsafe opening. No CWE, exploit details, or fixed version information are included here beyond the FortiGuard advisory reference.
Mitigation direction
- Check Fortinet advisory FG-IR-20-190 for fixed releases and vendor guidance.
- Upgrade affected FortiManager deployments according to Fortinet guidance.
- Restrict FortiManager administrative access to trusted users and management networks.
- Treat exported CSV or Excel files from affected systems as untrusted.
- Educate administrators not to open unexpected exports unsafely in Excel.
Validation and detection
- Inventory FortiManager versions and flag 6.4.3 and below, and 6.2.7 and below.
- Review who can modify policies and export policy data from FortiManager.
- Confirm whether administrators open FortiManager exports in Excel on managed workstations.
- Check endpoint telemetry for suspicious spreadsheet-triggered command activity, if available.
- Track remediation status against the Fortinet advisory rather than inferred fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-24016 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:X
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:X0.72.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.7LowVector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:X
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/advisory/FG-IR-20-190CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.